Crypto / Key / Controls / v2026.11
Enforce Automatic Rotation
CCC.KeyMgmt.CN03 · Encryption
Ensure symmetric keys rotate automatically within policy intervals to reduce exposure of key material.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.KeyMgmt.CP20 | Automatic Symmetric Key Rotation | The service may be configured to automatically generate new key material for a symmetric key at a user-defined interval, provided the key material was generated within the service, while retaining prior versions for decryption. |
| CCC.KeyMgmt.CP21 | Manual Key Rotation | The service can rotate a managed key on demand by generating a new key version, while retaining prior versions for decryption. |
| CCC.Core.CP01 | Encryption in Transit Enabled by Default | The service automatically encrypts all data using industry-standard cryptographic protocols prior to transmission via a network interface. |
| CCC.Core.CP02 | Encryption at Rest Enabled by Default | The service automatically encrypts all data using industry-standard cryptographic protocols prior to being written to a storage medium. |
| CCC.Core.CP35 | Customer-Managed Encryption Keys | The service may be configured to encrypt data at rest using a key that the user creates and controls in a key management service, instead of a key managed by the provider. |
Related Threats
| ID | Title | Description |
|---|
| CCC.KeyMgmt.TH03 | Key Rotation is Disabled or Delayed Beyond Policy Limits | Modification of automatic or manual rotation settings can keep older key material active longer than intended, decreasing cryptographic resilience and extending exposure in the event of key compromise. |
| CCC.Core.TH18 | Encryption Key is Misused | Encryption keys may be used by an unauthorized entity due to inadequate key management practices or the compromise of a connected system. This could lead to the decryption of sensitive data, impacting its confidentiality and integrity. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.KeyMgmt.CN03.AR01 | When a symmetric key is generated within the service, automatic rotation MUST be enabled on the key. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.KeyMgmt.CN03.AR02 | When automatic rotation is enabled on a key, the rotation interval MUST NOT exceed 365 days. | tlp-clear, tlp-green, tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST-CSF | PR.DS-1 | Data at rest is protected |
| NIST_800_53 | SC-12 | Cryptographic Key Establishment and Management |